Overview

overview

10

Static

static

8

2a5a44a913...17.exe

windows7_x64

10

2a5a44a913...17.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317

  • Size

    636KB

  • Sample

    220615-grmp9sgeen

  • MD5

    fcec8baab829067eb68ffda01b9a2282

  • SHA1

    85fcb5dd3af5c8544e282e1e4c7f1be21b4ca923

  • SHA256

    2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317

  • SHA512

    e5c03bc694ecb0f5a3d4c85bed91d44d9827687c0fa089b6c38190cd2711ecf286f40ad9594d4236d2af9052a839d92b53dd27d0eb91267247bdf6ac0585334b

Score
10/10
persistenceupx

Malware Config

Targets

    • Target

      2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317

    • Size

      636KB

    • MD5

      fcec8baab829067eb68ffda01b9a2282

    • SHA1

      85fcb5dd3af5c8544e282e1e4c7f1be21b4ca923

    • SHA256

      2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317

    • SHA512

      e5c03bc694ecb0f5a3d4c85bed91d44d9827687c0fa089b6c38190cd2711ecf286f40ad9594d4236d2af9052a839d92b53dd27d0eb91267247bdf6ac0585334b

    Score
    10/10
    persistenceupx

    • Modifies WinLogon for persistence

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks